ADS_SECURITY_INFO_ENUM 枚举 (iads.h)

项目
02/28/2024

ADS_SECURITY_INFO_ENUM 枚举指定用于检查对象安全数据的可用选项。

语法

typedef enum __MIDL___MIDL_itf_ads_0001_0077_0002 {
  ADS_SECURITY_INFO_OWNER = 0x1,
  ADS_SECURITY_INFO_GROUP = 0x2,
  ADS_SECURITY_INFO_DACL = 0x4,
  ADS_SECURITY_INFO_SACL = 0x8
} ADS_SECURITY_INFO_ENUM;

常量


`ADS_SECURITY_INFO_OWNER` 值： 0x1 读取或设置所有者数据。
`ADS_SECURITY_INFO_GROUP` 值： 0x2 读取或设置组数据。
`ADS_SECURITY_INFO_DACL` 值： 0x4 读取或设置自由访问控制列表数据。
`ADS_SECURITY_INFO_SACL` 值： 0x8 读取或设置系统访问控制列表数据。

注解

此枚举中定义的选项是位掩码。可以使用适当的按位运算设置多个选项。

若要读取对象的安全数据，请使用 IADsObjectOptions 接口，并提供此枚举中列出的安全数据选项。

以下列表列出了常见的标志组合及其用法。

标志组合	说明
ADS_SECURITY_INFO_OWNER、 ADS_SECURITY_INFO_GROUP和 ADS_SECURITY_INFO_DACL	使用户能够读取对象的所有者、组或 DACL 的安全数据。这是创建对象时的默认设置。
ADS_SECURITY_INFO_OWNER、 ADS_SECURITY_INFO_GROUP、 ADS_SECURITY_INFO_DACL 和 ADS_SECURITY_INFO_SACL	使用户能够读取 SACL。 ADS_SECURITY_INFO_SACL标志不能单独使用。

目前，此类选项仅适用于 Active Directory。

由于 Visual Basic Scripting Edition (VBScript) 无法从类型库读取数据，因此应用程序必须使用适当的数值常量而不是符号常量来设置适当的标志。若要将符号常量用作良好的编程做法，请编写此类常量的显式声明，如此处所示。

示例

下面的代码示例显示 SACL 中的访问控制条目数。

Const ADS_SECURITY_INFO_OWNER = &H1
Const ADS_SECURITY_INFO_GROUP = &H2
Const ADS_SECURITY_INFO_DACL = &H4
Const ADS_SECURITY_INFO_SACL = &H8

Const ADS_OPTION_SECURITY_MASK = 3

Dim x As IADs
Dim dso As IADsOpenDSObject
Dim adsPath As String
Dim sd As IADsSecurityDescriptor
Dim sacl As IADsAccessControlList
Dim objOps As IADsObjectOptions
Dim opt As Variant
Dim canReadSacl As Variant
 
Set dso = GetObject("LDAP:")
adsPath = "LDAP://ArcSrv1/dc=Sales,dc=Fabrikam,dc=com"
Set x = dso.OpenDSObject(adsPath, vbNullString, vbNullString, 1)
Set objOps = x
 
canReadSacl = ADS_SECURITY_INFO_OWNER _
                Or ADS_SECURITY_INFO_GROUP _
                Or ADS_SECURITY_INFO_DACL _
                Or ADS_SECURITY_INFO_SACL
 
opt = objOps.GetOption(ADS_OPTION_SECURITY_MASK)
If opt <> canReadSacl Then
    objOps.SetOption ADS_OPTION_SECURITY_MASK, canReadSacl
End If
Set sd = x.Get("ntSecurityDescriptor")
Set sacl = sd.SystemAcl
Debug.Print "sacl(aceCount)= " & sacl.AceCount

下面的代码示例显示系统 ACL 中的访问控制条目数。为简洁起见，省略了错误检查。

void TestObjectOptions()
{
    long lCanReadSACL = ADS_SECURITY_INFO_OWNER | 
        ADS_SECURITY_INFO_GROUP | 
        ADS_SECURITY_INFO_DACL | 
        ADS_SECURITY_INFO_SACL;

    HRESULT hr = S_OK;
    CComPtr<IADs> spObj;
    hr = ADsOpenObject(L"LDAP://arcSrv1/dc=Sales,dc=Fabrikam,dc=com", 
        NULL, 
        NULL,
        ADS_SECURE_AUTHENTICATION,
        IID_IADs,
        (void**)&spObj);
    if(S_OK != hr)
    {
        return;
    }

    CComPtr<IADsObjectOptions> spObjOps;
    hr = spObj->QueryInterface(IID_IADsObjectOptions, (void**)&spObjOps);
    if(S_OK != hr)
    {
        return;
    }

    CComVariant svar;
    hr = spObjOps->GetOption(ADS_OPTION_SECURITY_MASK, &svar);
    if(S_OK != hr)
    {
        return;
    }

    if(V_I4(&svar) != lCanReadSACL)
    {
        svar = lCanReadSACL;
        hr = spObjOps->SetOption(ADS_OPTION_SECURITY_MASK, svar);
    }

    hr = spObj->Get(CComBSTR("ntSecurityDescriptor"), &svar);
    if(S_OK != hr)
    {
        return;
    }

    CComPtr<IADsSecurityDescriptor> spSd;
    hr = V_DISPATCH(&svar)->QueryInterface(IID_IADsSecurityDescriptor, 
                                            (void**)&spSd);
    if(S_OK != hr)
    {
        return;
    }

    CComPtr<IDispatch> spDisp;
    hr = spSd->get_SystemAcl(&spDisp);
    if(S_OK != hr)
    {
        return;
    }

    CComPtr<IADsAccessControlList> spSacl;
    hr = spDisp->QueryInterface(IID_IADsAccessControlList, 
                                (void**)&spSacl);
    if(S_OK != hr)
    {
        return;
    }

    LONG lOptions;
    hr = spSacl->get_AceCount(&lOptions);
    if(S_OK != hr)
    {
        return;
    }

    _tprintf(TEXT("Number of ACE's in the SACL is %d\n"), lOptions);
}